token-goat 2.6.35 → 2.6.36

package/dist/{token-goat-chunk-I2KCEGIP.mjs → token-goat-chunk-UFOVM7ZN.mjs}

@@ -56,6 +56,7 @@ import {
   parse,
   precedingDocComment,
   propagateEndLinesToSymbols,
+  pushAll,
   recordStat,
   redactIfDotenv,
   redactSecrets,
@@ -88,7 +89,7 @@ import {
   withFileLock,
   writeIfDifferent,
   writeJsonSettings
-} from "./token-goat-chunk-K7W3P2TJ.mjs";
+} from "./token-goat-chunk-V465YKOR.mjs";
 import {
   registerReset
 } from "./token-goat-chunk-AO2QD2AG.mjs";
@@ -211,7 +212,7 @@ function collectElements(node, tag) {
       const obj = n;
       for (const [key, val] of Object.entries(obj)) {
         if (key === tag) {
-          if (Array.isArray(val)) out.push(...val);
+          if (Array.isArray(val)) pushAll(out, val);
           else out.push(val);
         } else if (val !== null && typeof val === "object") {
           walk(val);
@@ -2488,7 +2489,10 @@ function makeWorksheet(name, data) {
       },
       eachCell(opts, cb) {
         if (opts.includeEmpty) {
-          const maxCol = data.columnCount;
+          let maxCol = 0;
+          if (rowCells !== void 0) {
+            for (const c of rowCells.keys()) if (c > maxCol) maxCol = c;
+          }
           for (let c = 1; c <= maxCol; c++) cb(rowCells?.get(c) ?? EMPTY_CELL, c);
           return;
         }
@@ -5761,6 +5765,7 @@ function uninstallVscode(opts = {}) {
 }
 
 // src/session_store.ts
+import { createHash as createHash2 } from "node:crypto";
 import * as fs13 from "node:fs";
 import * as path10 from "node:path";
 
@@ -5987,9 +5992,22 @@ function sweepCacheRoots(extraRoots = []) {
 var MAX_FILES = 500;
 var SESSIONS_SUBDIR = "sessions";
 var AGENT_SALT_MARKER = sanitizeIdForFilename(":agent:");
+var AGENT_SALT_SEPARATOR = ":agent:";
+var AGENT_DIGEST_CHARS = 12;
+var SALTED_SESSION_MAX = 64 - AGENT_SALT_MARKER.length - AGENT_DIGEST_CHARS;
+function saltedStemPrefix(sessionId) {
+  return `${sanitizeIdForFilename(sessionId, SALTED_SESSION_MAX)}${AGENT_SALT_MARKER}`;
+}
+function sessionFileStem(sessionId) {
+  const sep = sessionId.indexOf(AGENT_SALT_SEPARATOR);
+  if (sep < 0) return sanitizeIdForFilename(sessionId, 64);
+  const agentId = sessionId.slice(sep + AGENT_SALT_SEPARATOR.length);
+  const digest = createHash2("sha256").update(agentId).digest("hex").slice(0, AGENT_DIGEST_CHARS);
+  return `${saltedStemPrefix(sessionId.slice(0, sep))}${digest}`;
+}
 function sessionPath(sessionId) {
   if (!sessionId) return null;
-  const safe = sanitizeIdForFilename(sessionId, 64);
+  const safe = sessionFileStem(sessionId);
   if (!safe) return null;
   const dir = path10.join(tokenGoatHome(), SESSIONS_SUBDIR);
   const candidate = path10.join(dir, `${safe}.json`);
@@ -6241,9 +6259,8 @@ function readSessionStateFile(sessionId) {
 }
 function listSiblingSessionStates(sessionId) {
   if (!sessionId) return [];
-  const safeSessionId = sanitizeIdForFilename(sessionId);
-  if (!safeSessionId) return [];
-  const prefix = `${safeSessionId}${AGENT_SALT_MARKER}`;
+  const prefix = saltedStemPrefix(sessionId);
+  if (prefix === AGENT_SALT_MARKER) return [];
   const dir = path10.join(tokenGoatHome(), SESSIONS_SUBDIR);
   const out = [];
   try {
@@ -6307,7 +6324,7 @@ function scanForInjectionPatterns(text) {
 var UNTRUSTED_WEB_TAG = "untrusted-web-content";
 function neutralizeFenceMarkers(text, tag) {
   const escapedTag = tag.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  const marker = new RegExp(`<\\s*/?\\s*${escapedTag}(?:\\s[^>]*)?\\s*/?\\s*>`, "gi");
+  const marker = new RegExp(`<\\s*/?\\s*${escapedTag}(?=[\\s/>])[^>]*>`, "gi");
   return text.replace(marker, (m) => m.replace(/</g, "&lt;").replace(/>/g, "&gt;"));
 }
 function fenceUntrustedContent(text, matchedPatternNames, tag = UNTRUSTED_WEB_TAG) {
@@ -6905,7 +6922,7 @@ function pruneSkillOutputs(maxCount = DEFAULT_MAX_COUNT, maxAgeMs = DEFAULT_MAX_
 }
 
 // src/image_shrink.ts
-import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash3 } from "node:crypto";
 import * as fs16 from "node:fs";
 import * as path12 from "node:path";
 
@@ -7107,7 +7124,7 @@ function imageShrinkCacheDir() {
   return path12.join(tokenGoatHome(), "image_shrink_cache");
 }
 function shrinkCacheKey(originalPath, size, mtimeMs, quality) {
-  return createHash2("sha256").update(`${originalPath}:${size}:${mtimeMs}:${quality}`).digest("hex").slice(0, 16);
+  return createHash3("sha256").update(`${originalPath}:${size}:${mtimeMs}:${quality}`).digest("hex").slice(0, 16);
 }
 function findCachedShrink(originalPath, size, mtimeMs, quality) {
   const key = shrinkCacheKey(originalPath, size, mtimeMs, quality);
@@ -7156,18 +7173,18 @@ function pruneShrinkCache() {
 }
 async function finalizeShrinkResult(result, filePath) {
   const basename12 = path12.basename(filePath);
+  const shrinkSaved = result.originalBytes - result.shrunkBytes;
+  recordStat("image_shrink", shrinkSaved, Math.round(shrinkSaved / 4), void 0, basename12);
   if (loadConfig().image_shrink.ocr_enabled) {
     const ocr = await ocrImage(result.data);
     if (ocr !== null && isTextHeavy(ocr, loadConfig().image_shrink.ocr_min_confidence)) {
       const textBytes = Buffer.byteLength(ocr.text, "utf8");
-      const saved2 = Math.max(0, result.shrunkBytes - textBytes);
-      recordStat("image_ocr", saved2, Math.round(saved2 / 4), void 0, basename12);
+      const saved = Math.max(0, result.shrunkBytes - textBytes);
+      recordStat("image_ocr", saved, Math.round(saved / 4), void 0, basename12);
       return contextOutput(formatOcrSummary(ocr, basename12, result.originalBytes));
     }
   }
-  const saved = result.originalBytes - result.shrunkBytes;
   const { summary, dataUrl } = formatShrinkSummary(result, basename12);
-  recordStat("image_shrink", saved, Math.round(saved / 4), void 0, basename12);
   return contextOutput(`${summary}
 ${dataUrl}`);
 }
@@ -7423,7 +7440,8 @@ function splitRangeIntoChunks(filePath, lines2, rangeStart, rangeEnd, chunkSize,
     const line = lines2[lineNo - 1] ?? "";
     const lineWithNewline = line + "\n";
     if (currentChunk.length + lineWithNewline.length > chunkSize && currentChunk.length > 0) {
-      const currentChunkTooSmall = currentChunk.trim().length < MIN_CHUNK_CHARS;
+      const trimmedLength = currentChunk.trim().length;
+      const currentChunkTooSmall = trimmedLength < MIN_CHUNK_CHARS;
       if (!currentChunkTooSmall) {
         chunks.push({
           filePath,
@@ -7433,12 +7451,21 @@ function splitRangeIntoChunks(filePath, lines2, rangeStart, rangeEnd, chunkSize,
           kind
         });
       }
-      const overlapLines = Math.ceil(overlap / 40);
-      const computedOverlapStart = Math.max(rangeStart, currentLine - overlapLines);
-      const overlapStart = currentChunkTooSmall ? Math.min(computedOverlapStart, startLine) : computedOverlapStart;
-      const overlapText = lines2.slice(overlapStart - 1, currentLine - 1).join("\n");
-      currentChunk = overlapText + "\n";
-      startLine = overlapStart;
+      let overlapChars = 0;
+      let computedOverlapStart = currentLine;
+      while (computedOverlapStart > rangeStart) {
+        const candidateChars = (lines2[computedOverlapStart - 2] ?? "").length + 1;
+        if (overlapChars + candidateChars > overlap) break;
+        overlapChars += candidateChars;
+        computedOverlapStart--;
+      }
+      const droppedChunkHadContent = currentChunkTooSmall && trimmedLength > 0;
+      const overlapStart = droppedChunkHadContent ? Math.min(computedOverlapStart, startLine) : computedOverlapStart;
+      if (overlapStart !== startLine) {
+        const overlapText = lines2.slice(overlapStart - 1, currentLine - 1).join("\n");
+        currentChunk = overlapText + "\n";
+        startLine = overlapStart;
+      }
     }
     currentChunk += lineWithNewline;
     currentLine++;
@@ -7587,7 +7614,7 @@ async function upsertChunks(db, chunks) {
       insertChunkVector(vectorInsertStmt, chunkResult.lastInsertRowid, embedding);
     }
   });
-  tx();
+  tx.immediate();
   return "embedded";
 }
 var BACKFILL_MULTIPLIER = 3;
@@ -12862,7 +12889,7 @@ function bracedBodyEndLine(content, lineIndex, parenIndex, totalLines, fallback)
     j++;
   }
   if (content[j] !== "{") return fallback;
-  return findMatchingBraceEndLine(content, j, totalLines, lineIndex, "#");
+  return findMatchingBraceEndLine(content, j, totalLines, lineIndex, "#", { backtickQuote: true });
 }
 function callEndLine(content, lineIndex, parenIndex, fallback) {
   const close = matchingParenIndex(content, parenIndex);
@@ -14747,21 +14774,22 @@ function maskSpans(content, spans) {
   }
   return chars.join("");
 }
-function componentSymbol(filePath, name, kind, totalLines) {
-  return { filePath, name, kind, lineStart: 1, lineEnd: totalLines, body: "", docstring: "", parent: "" };
+function componentSymbols(filePath, name, kind, totalLines) {
+  if (totalLines < 1) return [];
+  return [{ filePath, name, kind, lineStart: 1, lineEnd: totalLines, body: "", docstring: "", parent: "" }];
 }
 function extractVue(content, filePath) {
   const totalLines = countContentLines(content);
   const lineIndex = buildLineIndex(content);
   const name = componentName(filePath);
-  const symbols = [componentSymbol(filePath, name, "vue_component", totalLines)];
+  const symbols = componentSymbols(filePath, name, "vue_component", totalLines);
   const refs = [];
   for (const block of extractTagBlocks(content, lineIndex, "script")) {
-    symbols.push(...extractTopLevelDeclarations(block.content, filePath, block.contentStartLine));
+    pushAll(symbols, extractTopLevelDeclarations(block.content, filePath, block.contentStartLine));
   }
   for (const block of extractTagBlocks(content, lineIndex, "template")) {
     const markup = stripXmlComments(block.content);
-    refs.push(...extractComponentRefs(markup, filePath, block.contentStartLine, true));
+    pushAll(refs, extractComponentRefs(markup, filePath, block.contentStartLine, true));
   }
   return finalize(symbols, refs);
 }
@@ -14769,11 +14797,11 @@ function extractSvelte(content, filePath) {
   const totalLines = countContentLines(content);
   const lineIndex = buildLineIndex(content);
   const name = componentName(filePath);
-  const symbols = [componentSymbol(filePath, name, "svelte_component", totalLines)];
+  const symbols = componentSymbols(filePath, name, "svelte_component", totalLines);
   const refs = [];
   const scriptBlocks = extractTagBlocks(content, lineIndex, "script");
   for (const block of scriptBlocks) {
-    symbols.push(...extractTopLevelDeclarations(block.content, filePath, block.contentStartLine));
+    pushAll(symbols, extractTopLevelDeclarations(block.content, filePath, block.contentStartLine));
   }
   const styleBlocks = extractTagBlocks(content, lineIndex, "style");
   const spans = [...scriptBlocks, ...styleBlocks].map((b) => [
@@ -14781,7 +14809,7 @@ function extractSvelte(content, filePath) {
     b.matchEnd
   ]);
   const markup = stripXmlComments(maskSpans(content, spans));
-  refs.push(...extractComponentRefs(markup, filePath, 1, true));
+  pushAll(refs, extractComponentRefs(markup, filePath, 1, true));
   return finalize(symbols, refs);
 }
 function detectAstroFrontmatter(content) {
@@ -14802,7 +14830,7 @@ function extractAstro(content, filePath) {
   const totalLines = countContentLines(content);
   const lineIndex = buildLineIndex(content);
   const name = componentName(filePath);
-  const symbols = [componentSymbol(filePath, name, "astro_component", totalLines)];
+  const symbols = componentSymbols(filePath, name, "astro_component", totalLines);
   const refs = [];
   const lines2 = content.split("\n");
   const fm = detectAstroFrontmatter(content);
@@ -14810,7 +14838,7 @@ function extractAstro(content, filePath) {
   if (fm) {
     const frontmatterContent = lines2.slice(fm.openLine + 1, fm.closeLine).join("\n");
     const contentStartLine = fm.openLine + 2;
-    symbols.push(...extractTopLevelDeclarations(frontmatterContent, filePath, contentStartLine));
+    pushAll(symbols, extractTopLevelDeclarations(frontmatterContent, filePath, contentStartLine));
     const fenceStartOffset = lineIndex[fm.openLine] ?? 0;
     const fenceEndOffset = lineIndex[fm.closeLine + 1] ?? content.length;
     spans.push([fenceStartOffset, fenceEndOffset]);
@@ -14818,7 +14846,7 @@ function extractAstro(content, filePath) {
   const styleBlocks = extractTagBlocks(content, lineIndex, "style");
   for (const block of styleBlocks) spans.push([block.matchStart, block.matchEnd]);
   const markup = stripXmlComments(maskSpans(content, spans));
-  refs.push(...extractComponentRefs(markup, filePath, 1, false));
+  pushAll(refs, extractComponentRefs(markup, filePath, 1, false));
   return finalize(symbols, refs);
 }
 
@@ -16668,7 +16696,7 @@ function writeParseResult(filePath, content, result, dbPath) {
       insRef.run(r.filePath, r.name, r.line, r.col, r.context);
     }
   });
-  writeAll();
+  writeAll.immediate();
 }
 function indexFileSync(filePath, dbPath = globalDbPath(), preReadBytes) {
   const ixCfg = loadConfig().indexing;
@@ -16848,11 +16876,13 @@ function removeFileFromIndex(db, filePath) {
     deleteFileRows(db, filePath);
     deleteFileEmbeddings(db, filePath);
   });
-  tx();
+  tx.immediate();
 }
 function isTooShallowToPrune(rootPrefix) {
-  const segments = rootPrefix.split("/").filter((s) => s.length > 0 && !/^[a-z]:$/i.test(s));
+  const normalized = normalizePath(rootPrefix);
+  const segments = normalized.split("/").filter((s) => s.length > 0 && !/^[a-z]:$/i.test(s));
   if (segments.length === 2 && segments[0]?.toLowerCase() === "mnt" && /^[a-z]$/i.test(segments[1] ?? "")) return true;
+  if (normalized.startsWith("//") && segments.length <= 2) return true;
   return segments.length === 0;
 }
 function foldedBounds(rootPrefix) {
@@ -16877,7 +16907,8 @@ function findDeletablePaths(rootPrefix, dbPath) {
   for (const p of foldedPathsUnderRoot(rootPrefix, dbPath)) {
     let stillExists;
     try {
-      stillExists = fs27.statSync(p, { throwIfNoEntry: false }) !== void 0;
+      const st = fs27.statSync(p, { throwIfNoEntry: false });
+      stillExists = st !== void 0 && st.isFile();
     } catch {
       continue;
     }
@@ -16900,14 +16931,23 @@ function removeFilesBestEffort(db, paths) {
   return removed;
 }
 function removeDeletedFilesBestEffort(db, paths) {
-  const stillGone = paths.filter((p) => {
+  const removed = [];
+  for (const p of paths) {
+    let gone;
     try {
-      return fs27.statSync(p, { throwIfNoEntry: false }) === void 0;
+      const st = fs27.statSync(p, { throwIfNoEntry: false });
+      gone = st === void 0 || !st.isFile();
     } catch {
-      return false;
+      continue;
     }
-  });
-  return removeFilesBestEffort(db, stillGone);
+    if (!gone) continue;
+    try {
+      removeFileFromIndex(db, p);
+      removed.push(p);
+    } catch {
+    }
+  }
+  return removed;
 }
 function pruneDeletedFiles(rootPrefix, dbPath = globalDbPath()) {
   if (isTooShallowToPrune(rootPrefix)) return 0;
@@ -16985,7 +17025,7 @@ function sweepKnownRoots(dbPath = globalDbPath(), opts) {
     if (isTooShallowToPrune(root)) continue;
     let reachable;
     try {
-      reachable = fs27.existsSync(root);
+      reachable = fs27.statSync(root, { throwIfNoEntry: false })?.isDirectory() === true;
     } catch {
       reachable = false;
     }
@@ -17114,7 +17154,7 @@ function bumpRetryCount(dbPath, absPath) {
     db.prepare("INSERT INTO files (path, retry_count) VALUES (?, 1)").run(normalized);
     return 1;
   });
-  return tx();
+  return tx.immediate();
 }
 function clearRetryCount(dbPath, absPath) {
   try {

package/dist/{token-goat-chunk-K7W3P2TJ.mjs → token-goat-chunk-V465YKOR.mjs}

@@ -8,7 +8,7 @@ import {
 import { createRequire } from "node:module";
 function resolveVersion() {
   if (true) {
-    return "2.6.35";
+    return "2.6.36";
   }
   const require2 = createRequire(import.meta.url);
   const pkg = require2("../package.json");
@@ -770,6 +770,9 @@ function countContentLines(content) {
   const n = content.split("\n").length;
   return content.endsWith("\n") ? n - 1 : n;
 }
+function pushAll(target, items) {
+  for (const item of items) target.push(item);
+}
 function escapeRegExp(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
@@ -2449,7 +2452,6 @@ var ENV_KEYS2 = [
   "TOKEN_GOAT_OVERFLOW_MAX_TOKENS",
   "TOKEN_GOAT_HINT_JSON_SIDECAR",
   "TOKEN_GOAT_LARGE_READ_BYTES",
-  "TOKEN_GOAT_CURATOR",
   "TOKEN_GOAT_HINT_BUDGET",
   "TOKEN_GOAT_HOOK_WATCHDOG_MS",
   "TOKEN_GOAT_WEB_COMPRESS",
@@ -2510,8 +2512,19 @@ var _lastProjectConfigParseError = null;
 function getLastProjectConfigParseError() {
   return _lastProjectConfigParseError;
 }
-var PROJECT_LOCKED_SECTIONS = ["injection", "webfetch", "gdrive", "mcp", "network"];
-var PROJECT_LOCKED_KEYS = ["indexing.cross_project_symbols", "worker.blocked_roots"];
+var PROJECT_LOCKED_SECTIONS = [
+  "injection",
+  "webfetch",
+  "gdrive",
+  "mcp",
+  "network",
+  "screenshot"
+];
+var PROJECT_LOCKED_KEYS = [
+  "image_shrink.max_image_pixels",
+  "indexing.cross_project_symbols",
+  "worker.blocked_roots"
+];
 var _lastProjectConfigLockedKeys = [];
 function stripLockedProjectKeys(projectRaw) {
   const cleaned = {};
@@ -2642,10 +2655,12 @@ function resolveConfigKeyLayer(key, effectiveValue, cfg, projectInfo) {
   if (rawValueEquals(rawValue, effectiveValue)) return { layer: "project", path: projectInfo.path };
   return { layer: "project-invalid", path: projectInfo.path, rawValue, effectiveValue, reason: rejectionReason(key, rawValue, effectiveValue, cfg) };
 }
+function readConfigSource(p) {
+  return decodeSource(fs5.readFileSync(p));
+}
 function readConfigToml(p) {
   try {
-    const text = fs5.readFileSync(p, "utf8");
-    return { raw: parse(text), parseError: null };
+    return { raw: parse(readConfigSource(p)), parseError: null };
   } catch (e) {
     const code = e.code;
     if (code === "ENOENT") return { raw: {}, parseError: null };
@@ -2654,7 +2669,7 @@ function readConfigToml(p) {
 }
 function readConfigText(p) {
   try {
-    return { text: fs5.readFileSync(p, "utf8"), readError: null };
+    return { text: readConfigSource(p), readError: null };
   } catch (e) {
     const code = e.code;
     if (code === "ENOENT") return { text: null, readError: null };
@@ -2696,11 +2711,11 @@ function isAutoTriggerMultiplierExplicit() {
     return ca_raw["auto_trigger_multiplier"] !== void 0;
   };
   try {
-    if (setsMultiplier(fs5.readFileSync(configPath(), "utf8"))) return true;
+    if (setsMultiplier(readConfigSource(configPath()))) return true;
   } catch {
   }
   try {
-    return setsMultiplier(fs5.readFileSync(projectConfigPath(resolveConfigProjectRoot()), "utf8"));
+    return setsMultiplier(readConfigSource(projectConfigPath(resolveConfigProjectRoot())));
   } catch {
     return false;
   }
@@ -4179,6 +4194,7 @@ function propagateEndLinesToSymbols(symbols, sections) {
 }
 function findMatchingBraceEndLine(content, openBraceIndex, totalLines, lineIndex, lineCommentPrefix, opts) {
   const block = opts?.blockComment;
+  const backtick = opts?.backtickQuote === true;
   let depth = 0;
   let quote = null;
   for (let i = openBraceIndex; i < content.length; i++) {
@@ -4200,7 +4216,7 @@ function findMatchingBraceEndLine(content, openBraceIndex, totalLines, lineIndex
       while (i < content.length && content[i] !== "\n") i++;
       continue;
     }
-    if (ch === '"' || ch === "'") {
+    if (ch === '"' || ch === "'" || backtick && ch === "`") {
       quote = ch;
       continue;
     }
@@ -4723,7 +4739,7 @@ function purgeDotenvEmbeddings(conn) {
 var MIGRATIONS = {
   // v1 -> v2: adds files.embed_sha, tracked separately from files.sha so embedding freshness can be gated independently of parse freshness (see makeIndexer in worker.ts). A pre-existing v1 database's `files` table predates the column, so it needs an explicit ALTER TABLE here; a brand-new database already has the column from SCHEMA_SQL's CREATE TABLE above, so the ALTER TABLE would fail with "duplicate column name" there -- swallow exactly that error and rethrow anything else, so a genuine ALTER TABLE failure is never silently lost.
   1: (conn) => alterTableIdempotent(conn, "ALTER TABLE files ADD COLUMN embed_sha TEXT"),
-  // v2 -> v3: adds files.retry_count, a durable per-path counter for consecutive transient-read-failure requeues (see MAX_TRANSIENT_RETRIES / requeueDirtyPath / resetTransientRetryCount in worker.ts). Previously this counter lived only in an in-memory Map inside worker.ts, which meant resetTransientRetryCount -- called from appendDirtyPath (hooks_index.ts) in the short-lived hook CLI process -- could never actually reach the long-lived detached daemon process's own copy of that Map: they are different Node processes with no shared memory, so the reset was a silent no-op in the real deployed topology. Persisting the counter in `files` makes it visible to both processes via the one thing they do share: the index DB. Same swallow-duplicate-column pattern as v1 -> v2 above.
+  // v2 -> v3: adds files.retry_count, a durable per-path counter for consecutive transient-read-failure requeues (see MAX_TRANSIENT_RETRIES / requeueDirtyPath / clearRetryCount in worker.ts). Previously this counter lived only in an in-memory Map inside worker.ts, which meant the retry-count reset -- run at the time in the short-lived hook CLI process -- could never actually reach the long-lived detached daemon process's own copy of that Map: they are different Node processes with no shared memory, so the reset was a silent no-op in the real deployed topology. Persisting the counter in `files` makes it visible to both processes via the one thing they do share: the index DB. Same swallow-duplicate-column pattern as v1 -> v2 above.
   2: (conn) => alterTableIdempotent(conn, "ALTER TABLE files ADD COLUMN retry_count INTEGER NOT NULL DEFAULT 0"),
   // v8 -> v9: adds symbols.parent (see SCHEMA_VERSION comment above for why). A pre-existing v8 database's `symbols` table predates the column, so it needs an explicit ALTER TABLE here; a brand-new database already has the column from SCHEMA_SQL's CREATE TABLE above, so the ALTER TABLE would fail with "duplicate column name" there -- swallow exactly that error and rethrow anything else, same pattern as v1 -> v2 / v2 -> v3 above.
   8: (conn) => alterTableIdempotent(conn, "ALTER TABLE symbols ADD COLUMN parent TEXT NOT NULL DEFAULT ''"),
@@ -4743,13 +4759,32 @@ function runMigrations(conn, fromVersion, toVersion) {
     MIGRATIONS[v]?.(conn);
   }
 }
-function initConnection(conn) {
-  const walMode = conn.pragma("journal_mode = WAL", { simple: true });
-  if (String(walMode).toLowerCase() !== "wal") {
-    throw new Error(`db: failed to enable WAL mode (got: ${walMode})`);
+var WAL_SWITCH_DEADLINE_MS = 15e3;
+function enableWalWithRetry(conn, budgetMs = WAL_SWITCH_DEADLINE_MS) {
+  const deadline = Date.now() + budgetMs;
+  let lastError;
+  for (; ; ) {
+    try {
+      const mode = conn.pragma("journal_mode = WAL", { simple: true });
+      if (String(mode).toLowerCase() === "wal") return;
+      lastError = new Error(`got: ${String(mode)}`);
+    } catch (e) {
+      lastError = e;
+    }
+    try {
+      if (String(conn.pragma("journal_mode", { simple: true })).toLowerCase() === "wal") return;
+    } catch {
+    }
+    if (Date.now() >= deadline) {
+      throw new Error(`db: failed to enable WAL mode (${lastError instanceof Error ? lastError.message : String(lastError)})`);
+    }
+    sleepSync(25);
   }
-  conn.pragma("synchronous = NORMAL");
+}
+function initConnection(conn) {
   conn.pragma("busy_timeout = 15000");
+  enableWalWithRetry(conn);
+  conn.pragma("synchronous = NORMAL");
   conn.function(
     "TG_LOWER",
     { deterministic: true },
@@ -6106,7 +6141,14 @@ var SECRET_PATTERNS = [
   // realistic header ('{"alg":' or similar) always starts with "eyJ", so that's the practical
   // anchor here -- each of the three dot-separated segments requires a minimum length to avoid
   // matching a short, coincidentally dotted token.
-  ["jwt", /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g],
+  //
+  // The trailing `={0,2}` on each segment is what makes a padded token match. Base64url as the JWT
+  // spec defines it drops the `=` padding, but producers that reach for a plain base64 encoder
+  // emit it anyway, and a `=` in the header or payload segment used to defeat the match outright:
+  // not a partial redaction, but none at all, so the entire token was printed. `=` cannot appear
+  // anywhere except the end of a segment, since it is not one of the characters the segment body
+  // allows, so accepting it here cannot widen the match onto anything else.
+  ["jwt", /eyJ[A-Za-z0-9_-]{10,}={0,2}\.[A-Za-z0-9_-]{10,}={0,2}\.[A-Za-z0-9_-]{10,}={0,2}/g],
   ["npm_token", /npm_[A-Za-z0-9]{36}/g],
   // rk_live_ (restricted keys) share the sk_live_/sk_test_ secret-key shape and risk level, so
   // one pattern covers all three rather than adding a near-duplicate entry.
@@ -6301,6 +6343,7 @@ export {
   countNoun,
   excludeTestsHiddenNote,
   countContentLines,
+  pushAll,
   escapeRegExp,
   windowsCmdQuoteArg,
   redactUrlQuery,
@@ -6338,6 +6381,7 @@ export {
   lastProjectConfigLockedKeys,
   getProjectConfigInfo,
   resolveConfigKeyLayer,
+  readConfigSource,
   isAutoTriggerMultiplierExplicit,
   loadConfig,
   invalidateConfigCache,

package/dist/{token-goat-chunk-SIHYQCTM.mjs → token-goat-chunk-VYMGEVZS.mjs}

@@ -6,7 +6,7 @@ import {
   loadBlob,
   sanitizeFtsQuery,
   storeBlob
-} from "./token-goat-chunk-I2KCEGIP.mjs";
+} from "./token-goat-chunk-UFOVM7ZN.mjs";
 import {
   SYMBOL_BODY_CHAR_CAP,
   extractErrorMessage,
@@ -16,7 +16,7 @@ import {
   redactSecrets,
   runGit,
   shortFingerprint
-} from "./token-goat-chunk-K7W3P2TJ.mjs";
+} from "./token-goat-chunk-V465YKOR.mjs";
 import {
   registerReset
 } from "./token-goat-chunk-AO2QD2AG.mjs";
@@ -790,6 +790,7 @@ function formatCommandManifest(manifest) {
 
 // src/stdin_json.ts
 var DEFAULT_STDIN_TIMEOUT_MS = 5e3;
+var MAX_STDIN_WALL_MS = 6e4;
 var MAX_STDIN_BYTES = 64 * 1024 * 1024;
 function readStdinJson(timeoutMs = DEFAULT_STDIN_TIMEOUT_MS, maxBytes = MAX_STDIN_BYTES) {
   return new Promise((resolve2, reject) => {
@@ -799,16 +800,27 @@ function readStdinJson(timeoutMs = DEFAULT_STDIN_TIMEOUT_MS, maxBytes = MAX_STDI
     const finish = (fn) => {
       if (settled) return;
       settled = true;
-      clearTimeout(timer);
+      clearTimeout(idleTimer);
+      clearTimeout(wallTimer);
       process.stdin.removeListener("data", onData);
       process.stdin.removeListener("end", onEnd);
       process.stdin.removeListener("error", onError);
       fn();
     };
-    const timer = setTimeout(() => {
+    let idleTimer = setTimeout(() => {
       finish(() => reject(new Error("readStdinJson: timed out waiting for stdin")));
     }, timeoutMs);
+    const wallTimer = setTimeout(() => {
+      finish(() => {
+        process.stdin.destroy();
+        reject(new Error(`readStdinJson: stdin took longer than ${MAX_STDIN_WALL_MS} ms`));
+      });
+    }, MAX_STDIN_WALL_MS);
     const onData = (chunk) => {
+      clearTimeout(idleTimer);
+      idleTimer = setTimeout(() => {
+        finish(() => reject(new Error("readStdinJson: timed out waiting for stdin")));
+      }, timeoutMs);
       totalBytes += chunk.length;
       if (totalBytes > maxBytes) {
         finish(() => {

package/dist/{token-goat-chunk-DQIT5JIF.mjs → token-goat-hook-chunk-3ZDBWJDF.mjs}

@@ -4,7 +4,7 @@ import {
   loadConfig,
   redactSecrets,
   stripAnsiCodes
-} from "./token-goat-chunk-K7W3P2TJ.mjs";
+} from "./token-goat-hook-chunk-Y2WHX2P3.mjs";
 
 // src/tool_filters/helpers.ts
 import * as fs from "node:fs";

package/dist/{token-goat-hook-chunk-CRBMPT74.mjs → token-goat-hook-chunk-5UH54CW6.mjs}

@@ -6,7 +6,7 @@ import {
   loadBlob,
   sanitizeFtsQuery,
   storeBlob
-} from "./token-goat-hook-chunk-XM4W3WCO.mjs";
+} from "./token-goat-hook-chunk-A77A26A7.mjs";
 import {
   SYMBOL_BODY_CHAR_CAP,
   extractErrorMessage,
@@ -16,7 +16,7 @@ import {
   redactSecrets,
   runGit,
   shortFingerprint
-} from "./token-goat-hook-chunk-2O7P4Z6Q.mjs";
+} from "./token-goat-hook-chunk-Y2WHX2P3.mjs";
 import {
   registerReset
 } from "./token-goat-hook-chunk-BUOCULAM.mjs";
@@ -183,6 +183,7 @@ var HOOK_EVENTS = [
 
 // src/stdin_json.ts
 var DEFAULT_STDIN_TIMEOUT_MS = 5e3;
+var MAX_STDIN_WALL_MS = 6e4;
 var MAX_STDIN_BYTES = 64 * 1024 * 1024;
 function readStdinJson(timeoutMs = DEFAULT_STDIN_TIMEOUT_MS, maxBytes = MAX_STDIN_BYTES) {
   return new Promise((resolve2, reject) => {
@@ -192,16 +193,27 @@ function readStdinJson(timeoutMs = DEFAULT_STDIN_TIMEOUT_MS, maxBytes = MAX_STDI
     const finish = (fn) => {
       if (settled) return;
       settled = true;
-      clearTimeout(timer);
+      clearTimeout(idleTimer);
+      clearTimeout(wallTimer);
       process.stdin.removeListener("data", onData);
       process.stdin.removeListener("end", onEnd);
       process.stdin.removeListener("error", onError);
       fn();
     };
-    const timer = setTimeout(() => {
+    let idleTimer = setTimeout(() => {
       finish(() => reject(new Error("readStdinJson: timed out waiting for stdin")));
     }, timeoutMs);
+    const wallTimer = setTimeout(() => {
+      finish(() => {
+        process.stdin.destroy();
+        reject(new Error(`readStdinJson: stdin took longer than ${MAX_STDIN_WALL_MS} ms`));
+      });
+    }, MAX_STDIN_WALL_MS);
     const onData = (chunk) => {
+      clearTimeout(idleTimer);
+      idleTimer = setTimeout(() => {
+        finish(() => reject(new Error("readStdinJson: timed out waiting for stdin")));
+      }, timeoutMs);
       totalBytes += chunk.length;
       if (totalBytes > maxBytes) {
         finish(() => {

package/dist/{token-goat-hook-chunk-VU6VGZBM.mjs → token-goat-hook-chunk-6ODM3MP7.mjs}

@@ -25,7 +25,7 @@ import {
   runSkeleton,
   runSymbol,
   withPinnedReads
-} from "./token-goat-hook-chunk-NXVT4F3S.mjs";
+} from "./token-goat-hook-chunk-MW5HPEGD.mjs";
 import {
   buildProjectMap,
   embeddingsDepsAvailable,
@@ -34,7 +34,7 @@ import {
   getProjectIndexCounts,
   isWorkerRunning,
   mapLookupBytesSaved
-} from "./token-goat-hook-chunk-XM4W3WCO.mjs";
+} from "./token-goat-hook-chunk-A77A26A7.mjs";
 import {
   VERSION,
   dataDir,
@@ -45,7 +45,7 @@ import {
   normalizePath,
   recordStat,
   resolveProjectRoot
-} from "./token-goat-hook-chunk-2O7P4Z6Q.mjs";
+} from "./token-goat-hook-chunk-Y2WHX2P3.mjs";
 import "./token-goat-hook-chunk-BUOCULAM.mjs";
 import "./token-goat-hook-chunk-RFRLWOQH.mjs";